CN107291586B - Application program analysis method and device - Google Patents
Application program analysis method and device Download PDFInfo
- Publication number
- CN107291586B CN107291586B CN201610203095.6A CN201610203095A CN107291586B CN 107291586 B CN107291586 B CN 107291586B CN 201610203095 A CN201610203095 A CN 201610203095A CN 107291586 B CN107291586 B CN 107291586B
- Authority
- CN
- China
- Prior art keywords
- function
- application program
- software
- hardware
- running
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3058—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations
- G06F11/3062—Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations where the monitored property is the power consumption
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Stored Programmes (AREA)
- Telephone Function (AREA)
Abstract
The invention discloses an application program analysis method and device, which are used for analyzing an application program through a mobile terminal and improving the efficiency of application program analysis. The embodiment of the invention provides an application program analysis method, which comprises the following steps: determining an application program which needs to be monitored by a user from a mobile terminal; acquiring configuration information of software and hardware called when the application program runs in the mobile terminal; when the application program is started in the mobile terminal, monitoring the calling condition of calling the software and the hardware by the function configured in the application program and the running condition of the software and the hardware running according to the function according to the configuration information of the software and the hardware; and analyzing the application program according to the calling condition of the function to the software and the hardware and the running condition of the software and the hardware according to the running of the function.
Description
Technical Field
The invention relates to the technical field of computers, in particular to an application program analysis method and device.
Background
At present, a mobile terminal is an important entrance of a mobile internet, and application programs installed in the mobile terminal are also various and increasingly diversified. Therefore, there is a need for monitoring various applications in a mobile terminal to manage the applications. For example, the battery power of the mobile terminal is limited, and the power consumption of an application program running in the mobile terminal needs to be tracked and analyzed.
In an implementation scenario at present, when monitoring the operation of an application program in a mobile terminal, the mobile terminal needs to be connected to a computer in real time, the operation state of the mobile terminal is saved into a file, and then the application program in the mobile terminal is manually analyzed. Because files need to be stored in real time in the current implementation scene, the operation process is complex, and the analysis result cannot be directly checked on the mobile terminal, so that the analysis efficiency of the application program is very low. In addition, in the current implementation scenario, after the file is stored in real time, the code logic needs to be analyzed manually, and a large number of tests are needed to find problems, so that time and labor are consumed, and the efficiency is low.
Disclosure of Invention
The embodiment of the invention provides an application program analysis method and device, which are used for analyzing an application program through a mobile terminal and improving the efficiency of application program analysis.
In order to solve the above technical problems, embodiments of the present invention provide the following technical solutions:
in a first aspect, an embodiment of the present invention provides an application analysis method, including:
determining an application program which needs to be monitored by a user from a mobile terminal;
acquiring configuration information of software and hardware called when the application program runs in the mobile terminal;
when the application program is started in the mobile terminal, monitoring the calling condition of calling the software and the hardware by the function configured in the application program and the running condition of the software and the hardware running according to the function according to the configuration information of the software and the hardware;
and analyzing the application program according to the calling condition of the function to the software and the hardware and the running condition of the software and the hardware according to the running of the function.
In a second aspect, an embodiment of the present invention further provides an apparatus for analyzing an application program, including:
the program determining module is used for determining an application program which needs to be monitored by a user from the mobile terminal;
the configuration acquisition module is used for acquiring configuration information of software and hardware called when the application program runs in the mobile terminal;
the function monitoring module is used for monitoring the calling condition of calling the software and the hardware by the function configured in the application program and the running condition of the software and the hardware running according to the function according to the configuration information of the software and the hardware when the application program is started in the mobile terminal;
and the analysis module is used for analyzing the application program according to the calling condition of the function to the software and the hardware and the running condition of the software and the hardware according to the running of the function.
According to the technical scheme, the embodiment of the invention has the following advantages:
in the embodiment of the invention, an application program which needs to be monitored by a user is determined from a mobile terminal, then configuration information of software and hardware called when the application program runs in the mobile terminal is obtained, when the application program is started in the mobile terminal, the calling condition of function calling software and hardware configured in the application program and the running condition of the software and hardware running according to the function are monitored according to the configuration information of the software and the hardware, and the application program is analyzed according to the calling condition of the function to the software and the hardware and the running condition of the software and the hardware running according to the function. In the embodiment of the invention, the analysis of the application program can be completed through the mobile terminal, and the function configured in the application program can be monitored, so that the monitoring on the function level is realized, and the obtained calling condition and the operation condition are also the functions configured aiming at the bottom layer in the application program, therefore, the application program can be analyzed more finely, the analysis time of the application program is shortened, and the analysis efficiency of the application program is improved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings.
Fig. 1 is a schematic flowchart illustrating an analysis method for an application according to an embodiment of the present invention;
fig. 2 is a schematic application flow diagram of an application program power consumption positioning analysis method according to an embodiment of the present invention;
fig. 3 is a schematic view of an implementation scenario of a running process in a mobile terminal according to an embodiment of the present invention;
fig. 4 is a schematic diagram illustrating a storage manner of a code file in a mobile terminal according to an embodiment of the present invention;
fig. 5-a is a schematic diagram of an analysis result of power consumption analysis performed on an application program in a mobile terminal according to an embodiment of the present invention;
fig. 5-b is a schematic diagram of another analysis result of power consumption analysis performed on an application program in a mobile terminal according to an embodiment of the present invention;
fig. 5-c is a schematic diagram of another analysis result of power consumption analysis performed on an application program in a mobile terminal according to an embodiment of the present invention;
FIG. 6-a is a schematic diagram of a component structure of an analysis apparatus for an application according to an embodiment of the present invention;
fig. 6-b is a schematic diagram of a structure of a function monitoring module according to an embodiment of the present invention;
fig. 7 is a schematic structural diagram of a terminal to which the method for analyzing an application according to the embodiment of the present invention is applied.
Detailed Description
The embodiment of the invention provides an application program analysis method and device, which are used for analyzing an application program through a mobile terminal and improving the efficiency of application program analysis.
In order to make the objects, features and advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the embodiments described below are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments that can be derived by one skilled in the art from the embodiments given herein are intended to be within the scope of the invention.
The terms "comprises" and "comprising," and any variations thereof, in the description and claims of this invention and the above-described drawings are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such process, method, article, or apparatus.
The following are detailed below.
Referring to fig. 1, an embodiment of the method for analyzing an application program according to the present invention may be specifically applied to an automatic analysis process of an application program in a mobile terminal, and the method for analyzing an application program according to an embodiment of the present invention may include the following steps:
101. and determining the application program which needs to be monitored by the user from the mobile terminal.
In the embodiment of the present invention, the mobile terminal is operated by the user, and the user may determine which application program or application programs in the mobile terminal need to be monitored, for example, the user operates the mobile terminal, and the user clicks and selects the application program that needs to be monitored, so that which application program installed in the mobile terminal needs to be monitored may be determined according to the operation behavior of the user.
102. And acquiring configuration information of software and hardware called when the application program runs in the mobile terminal.
After determining an application program needing to be monitored in the mobile terminal, acquiring which software and hardware in the mobile terminal need to be called when the application program runs according to the program configuration requirement of the application program, and for different application programs installed in the mobile terminal, calling different terminal software and hardware configurations when the application program runs. The configuration information of the software and the hardware in the embodiment of the present invention may refer to information such as detailed configuration, calling manner, and storage path of the software and the hardware in the mobile terminal, and the corresponding configuration information may be specifically configured for different software and hardware in the mobile terminal.
In some embodiments of the present invention, the configuration information of the software and the hardware acquired in step 102 may specifically include at least one of the following information: the configuration of a Central Processing Unit (CPU), the configuration of a Global Positioning System (GPS), the configuration of a Wireless local area network (WiFi), the configuration of a wake lock program, the configuration of a sensor, the configuration of a multimedia scanning program, and the configuration of bluetooth. For example, an application of an instant messenger may need to call the CPU, WiFi, and possibly GPS in the mobile terminal when running. For another example, the running fitness application program needs to call a CPU and a gravity sensor in the mobile terminal when running. It can be understood that, in the embodiment of the present invention, for different application programs that need to be monitored, configuration information of software and hardware in the mobile terminal may be acquired differently, and the terminal software and hardware that the application programs need to call may be determined by combining a specific application scenario, so as to acquire the configuration information of the terminal software and hardware.
In some embodiments of the present invention, the step 102 monitors, according to the configuration information of the software and the hardware, a calling condition of the function calling software and the hardware configured in the application program and an operation condition of the software and the hardware operating according to the function, and specifically may include the following steps:
a1, determining the function which needs to be executed and is configured in the application program;
a2, modifying a call pointer of a function to be executed in a mode of reconfiguring a virtual machine operated by an application program;
and A3, starting monitoring the function before the function starts to execute according to the modified call pointer, and monitoring the calling condition of the function to the software and the hardware in the whole execution process from the start to the end of the execution of the function and the running condition of the software and the hardware running according to the function.
The method includes determining which function needs to be monitored, for example, according to a calling sequence of all functions configured in the application program, or according to a pre-configured code region range. After determining the function to be monitored, the execution mode of the function and the specific software and hardware to be called can be determined, then the virtual machine operated by the application program is reconfigured, the call pointer of the function to be executed is modified, the call pointer points to the trigger of the monitoring flow, the function is monitored before the function starts to be executed according to the modified call pointer, and the calling condition of the function to the software and hardware and the operation condition of the software and hardware according to the function operation in the whole execution process from the start of the function to the end of the execution are monitored. For example, a java virtual machine in which an application program runs may be reconfigured, where a call pointer points to monitor and start before a function starts to execute, and after the function starts to be monitored, specific software and hardware are started to be called according to configuration requirements of the function, and after the software and hardware are called, the software and hardware run according to the configuration requirements of the function, and at this time, the whole execution process of the function needs to be monitored, so as to analyze a function configured by the application program in a subsequent step.
In other embodiments of the present invention, the step 102, according to the configuration information of the software and the hardware, monitors the calling condition of the function calling software and the hardware configured in the application program and the running condition of the software and the hardware running according to the function, and specifically may include the following steps:
b1, recording the type of software and hardware called by the function, the stack of the function, the time of starting the function and the time of finishing the function when the function is executed, and calculating the running time of the software and the hardware according to the function and the total running times of the function.
The above implementation describes the specific implementation flow of monitoring in detail, for example, during the whole execution process of the function from the beginning to the end of execution, the type of software and hardware called by the function is recorded, such as which software and which software in the mobile terminal are called by the function, and the stack of the function running is also recorded, for example, the stack is obtained by calling the printstack method of the system, each function has a unique stack, and the running stack can help the user locate a specific code line. The time of starting execution and the time of ending execution of the function can be recorded during the execution of the function, the running time of the software and the hardware according to the function operation can be determined through the difference of the two times, and the total running times of the function can be accumulated through the statistics of a plurality of times of starting execution of the function. It can be understood that, in an analysis scenario where different functions are required to be performed on an application, a specific calling situation and a running situation that need to be monitored may also vary correspondingly, and the specific calling situation and the running situation are not limited herein.
103. When the application program is started in the mobile terminal, the calling condition of the function calling software and the hardware configured in the application program and the running condition of the software and the hardware running according to the function are monitored according to the configuration information of the software and the hardware.
In the embodiment of the present invention, after the software and the hardware called by the application program to be monitored are obtained through the foregoing steps, configuration information of the software and the hardware also needs to be obtained. The application program can be monitored next, the application program can be analyzed to obtain the function configured by the application program, and the application program is executed by specific function call finally when running. For example, a possible implementation manner is that all functions in the application program can be monitored, that is, for each function configured in the application program, software and hardware called by each function and an operation condition of the software and hardware according to each function are monitored. Another possible implementation manner is that specific function configuration algorithms may be combined to determine which functions in the application need to be monitored, for example, to reduce the overhead caused by monitoring, only half of the functions in all the functions configured in the application are monitored, and the selected half of the functions may be determined as follows, and every other function in the application is monitored. Another possible implementation is to determine the specific function to be monitored according to the storage location of the code line in the application program, or according to the function classification of the function in the application program. It should be noted that, in the embodiment of the present invention, the function layer of the bottom layer in the application program is monitored, the specific software and hardware for function call are monitored, and the function is monitored without affecting the execution of the function itself, because the software and hardware for monitoring function call are directly executed in the memory of the mobile terminal and do not need to be stored as separate files.
It should be noted that, in the embodiment of the present invention, the application program is monitored in step 103 when the application program is started, so that the whole running process of the application program can be monitored comprehensively in real time, and when functions configured in the application program are monitored, the calling situations of the functions to software and hardware and the running situations of the software and hardware can be generated in real time, where the calling situations of the functions to the software and hardware and the running situations of the software and hardware running according to the functions can be specifically exemplified according to a specific application scenario, and reference is made to the examples of the calling situations and the running situations in the mobile terminal in the subsequent embodiments.
104. And analyzing the application program according to the calling condition of the function to the software and the hardware and the running condition of the software and the hardware according to the function running.
In the embodiment of the present invention, after the function configured in the application program is monitored in step 103, the calling condition of the function to the software and the hardware and the running condition of the software and the hardware running according to the function can be obtained, and the analysis of the application program can be performed by monitoring the function in the application program in step 103, wherein the specific execution process of the function in the application program is recorded in the calling condition of the function to the software and the running condition of the software and the hardware running according to the function, and the specific function having an abnormal problem in the application program can be located by combining the specific comparison standard of the software and the hardware. In step 104, there may be various implementation manners for analyzing the application program according to the calling condition and the running condition, but through analyzing the function hierarchy in the application program, it is convenient to accurately find the problems existing in the application program in time, so that the application program developer can perform subsequent improvement on the application program. The monitoring on the function level in the embodiment of the invention can accurately position the specific code in the application program, is suitable for the analysis process of application program developers on the application program, and reduces the difficulty of positioning problems of the application program developers.
In some embodiments of the present invention, in an implementation scenario executed in step B1, analyzing the application program according to a call condition of the function to the software and the hardware in step 104 and an operation condition of the software and the hardware according to the function operation in step B1 may specifically include the following steps:
c1, analyzing the function with abnormal conditions in the application program according to the running time of the function and the total running times of the function, and analyzing the stack corresponding to the function with abnormal conditions in the application program.
After the running time of the function and the total running times of the function are obtained, which function in the application program has an abnormal condition is analyzed according to the running time of the function and the total running times of the function. For example, the abnormal condition may specify corresponding comparison criteria according to different types of functions, determine whether the running time and the total running times of the functions in the application program will exceed the preconfigured comparison criteria, for the functions exceeding the comparison criteria, it may be determined that the function is a function in the application program in which the abnormal condition exists, as can be known from the description of the foregoing step B1, a stack in which the function runs is recorded, for the function in which the abnormal condition exists, the stack corresponding to the function may be analyzed, and the stack may directly locate the code line in which the abnormal condition exists. It should be noted that the abnormal condition of the function in the application program may refer to that the power consumption condition of the function is abnormal, or the execution of the function may have a malicious result, for example, stealing the terminal traffic of the user or stealing the account information of the user.
Further, in another embodiment of the present invention, the step C1 analyzes a function with an abnormal condition in the application program according to the running time of the function and the total number of times of running the function, and analyzes a stack corresponding to the function with the abnormal condition in the application program, which may specifically include the following steps:
c11, calculating a program silent period between the application program is switched from the foreground system of the mobile terminal to the background system of the mobile terminal until the application program is switched back to the foreground system from the background system;
and C12, if the function in the mobile terminal is executed in the program silent period, determining that the function executed in the program silent period in the application program has an abnormal condition, and analyzing the stack corresponding to the function with the abnormal condition.
Taking the switching of the application program between the foreground system and the background system of the mobile terminal as an example to determine the function with the abnormal condition, the first time point t1 when the application program is switched from the foreground system to the background system of the mobile terminal is recorded, at this time, the application program is returned to the background system of the mobile terminal, at this time, the application program is reserved in the background system, and there should not be too much behavior of consuming system resources, when the application program is switched back to the foreground system, the current second time point t2 is recorded, and the time period of the application program staying in the background can be calculated according to the time difference between the second time point and the first time point, that is, the program silent period of the application program is (t1, t2), because the embodiment of the present invention monitors the running of the function in the application program, it can be determined which function in the application program silent period (t 1) is in the application program silent period (t 1), t2), the function executed between the program silent periods (t1, t2) can be regarded as an abnormal function executed when the application program exits to the background system, the stack corresponding to the abnormal function can be used for analyzing the abnormal behavior of the abnormal function, and the application program developer can perform debugging analysis on the abnormal function.
In some embodiments of the present invention, the method for analyzing an application program provided in the embodiments of the present invention may further connect the mobile terminal to a computer in real time, and analyze functions called during running of a CPU, a GPS, a WiFi, and the like in the mobile terminal in real time. For example, a user may connect to a computer with a mobile terminal and be analyzed by a terminal monitoring tool installed in the computer. For example, a Dalvik virtual machine debugging and monitoring Service (DDMS) tool is installed in a computer, a user operates the DDMS tool, the DDMS sends a command to the mobile terminal according to the requirement of the user, then the DDMS tool starts to record functions called when the CPU, the GPS, the WiFi, and the like run, obtains the functions required to run in the running state of the mobile terminal in real time, and then analyzes the application program according to the calling condition of the functions to the software and hardware and the running condition of the software and hardware running according to the functions, which is described in detail in the foregoing embodiments and is not repeated herein.
As can be seen from the above description of the embodiments of the present invention, first, an application program that a user needs to monitor is determined from a mobile terminal, then configuration information of software and hardware that the application program calls when running in the mobile terminal is obtained, when the application program is started in the mobile terminal, a call condition of function call software and hardware configured in the application program and an operation condition of the software and hardware operating according to the function are monitored according to the configuration information of the software and hardware, and the application program is analyzed according to the call condition of the function to the software and hardware and the operation condition of the software and hardware operating according to the function. In the embodiment of the invention, the analysis of the application program can be completed through the mobile terminal, and the function configured in the application program can be monitored, so that the monitoring on the function level is realized, and the obtained calling condition and the operation condition are also the functions configured aiming at the bottom layer in the application program, therefore, the application program can be analyzed more finely, the analysis time of the application program is shortened, and the analysis efficiency of the application program is improved.
In order to better understand and implement the above-mentioned schemes of the embodiments of the present invention, the following description specifically illustrates corresponding application scenarios. Taking the application program analysis method provided by the embodiment of the invention applied to the automatic analysis of the power consumption of the program as an example, the embodiment of the invention can capture the state information of the application program, automatically analyze the power consumption problem of the program according to a strategy, and provide the running address of the corresponding program code, thereby facilitating the positioning of the problem for application program developers. The embodiment of the invention can acquire the power consumption reason of the target program under the condition of not influencing the use of the user, and position the specific code, thereby facilitating the developer to re-optimize the power consumption problem.
The analysis method of the application program provided by the embodiment of the invention can be completed through the monitoring module realized at the mobile terminal side, and the monitoring module can achieve the effect of monitoring the operation flow of the third-party application program by modifying the virtual machine. The calls are classified by obtaining the operation and calling of software and hardware in the mobile terminal: CPU call, wake-up system call, GPS use, WiFi scanning, multimedia scanning, Bluetooth scanning and the like. According to each classification, the standard is compared with the standard, the standard is obtained according to the user data and the working experience at ordinary times, for example, the awakening system still awakens for 5 minutes after the screen is turned off, and the standard is considered to be out of the standard. And for the project early warning prompt exceeding the standard, developers can observe the running calling relation according to the project exceeding the standard, so that the abnormal problem codes can be easily positioned to realize the position.
Referring to fig. 2, fig. 2 is a schematic view of an application flow of the power consumption positioning analysis of the application program by the analysis method of the application program according to the embodiment of the present invention, which mainly includes the following flows:
1, the user specifies the application program to be monitored.
First, all running processes in the mobile terminal may be listed, please refer to fig. 3, where fig. 3 is a schematic view of an implementation scenario of the running processes in the mobile terminal according to the embodiment of the present invention, and a user may select an application program to be monitored, and may know the total running times and time of all types of calls after the monitoring is completed.
For example, the partial code of an application is as follows:
in the code of the application program, an object class requiring hook and an object function requiring hook are determined. For example, the functions to be monitored are as follows: android, hardware, LegacySensorManager, registerLegacyListener, unregisterLegacyListener.
And determining the software and hardware classification required to be called by the application program, wherein the software and hardware classification is currently classified into categories such as CPU, GPS, WiFi and the like.
And 2, injecting a dynamic library (English name: so) of the monitoring module into a third-party application program through ptrace.
And 3, starting the Bridge to load the monitoring module.
And 4, the monitoring module acquires configurations such as a CPU, a GPS, WiFi and the like which need to be monitored.
And 5, reading the configuration of the monitoring module.
And 6, the monitoring module starts monitoring the CPU, the GPS, the WiFi and the like.
All the application programs installed in the mobile terminal need to be executed by function call at last, so that hijacking can be performed at the function call place at the lowest layer, the former direct call function A () is changed into the former direct call function A (), the former direct call function A () is executed firstly, then the former direct call function A () is executed, and finally the later () is executed. And recording the starting time and running a call stack at before, recording the completion time at the end, and sorting and displaying the data when a user needs to check the monitoring result.
An example implementation of monitoring a third party application is as follows: through the ptrace technology, the dynamic library can be injected into a third-party application program, the dynamic library is enabled to run in the process of the third-party application program, then the bridge jar package is pulled up through the dynamic library, the configuration to be monitored can be read in the bridge, then the java virtual machine run by the third-party application program is modified according to the configuration, the call pointer of the third-party program function is changed, and the pointer points to the method in the bridge, so that the purpose of monitoring the function running is achieved. The hook-fetching (English name: hook) operation flow in the bridge comprises the following steps: the method that the original function calls- > the pointer is modified by the bridge- > calls the bridge is that the following operation flow is executed: beforeHook, 2. primitive function call, 3. asterhook. The primitive function call start time and call stack are recorded at beforcehook (e.g., by printing stack) and the end time is recorded at afterhook, the difference between which can determine the total elapsed time of the primitive function call.
And 7, the running time and the running calling relation of the application program with any configuration are recorded.
8, the user needs to obtain the monitoring result.
And 9, packaging the monitoring data and storing the monitoring data in a local directory.
And 10, informing the monitoring module to acquire data.
11, displaying according to the categories of CPU, GPS and the like.
After the operation conditions of each category are displayed, which functions have abnormal conditions can be analyzed. For example, an exception is defined as an operation when a program is running in the background, since the programs are all running in the background, theoretically there should not be too many operations consuming system resources, resulting in undesirable power consumption. The application running, which cannot be perceived by the user, causes unnecessary power consumption, and such unnecessary operation is considered as an abnormality. For example, a program itself has a background program, but the user does not know that the program is considered abnormal. But the user actively opens a piece of navigation software, but this is needed by the user and is therefore not an anomalous application. For another example, when the program falls back to the background, the current time a is recorded, and when the program goes from the background to the foreground, a time B is recorded, and according to the starting time of the original function call, the time is found to be in the (a, B) interval and is considered to be suspicious power consumption, and the user is required to analyze the power consumption through the stack.
For example, as shown in fig. 4, fig. 4 is a schematic view illustrating a storage manner of a code file in a mobile terminal according to an embodiment of the present invention, the code file in an android is stored in an application, a dex file is stored in a decompressed application, the dex file is a compressed file of all class files, all classes in the dex can be read by a method provided by the android, and then functions corresponding to all classes can be traversed according to all classes, so that all the functions are hook.
The time and times calculation of the CPU, GPS, WiFi, sensor, wakelock in the embodiment of the present invention will be described below. The CPU is different from the others, and the others are the same algorithm. For example, in the CPU algorithm, since any of the functions that have been hook are changed into before () - > objective function- > after (), the CPU runtime is the time of subtracting before from all after, and the runtime number of the objective function is the sum of the runtime numbers of the objective function. Since the same way of calculation is performed except for the CPU, and the sensor needs to know the on time of the sensor next, taking the sensor calculation as an example, the above configuration requires hook register legacy requester (start to enable the sensor), unregisterlegacy legacy requester (end to enable the sensor), that is, before () - > register legacy requester- > after (). This time corresponds to (before of unregisterlegocylistener) minus (before of registerlestriurenerer) to know how long the sensor was turned on for the application, the number of times being one switch cycle.
Special remarks are made for the case of running in the background 12.
And 13, watching the abnormal operation condition.
First, please refer to fig. 5-a, where fig. 5-a is a schematic diagram of an analysis result of power consumption analysis (english name: power diagnostics) performed on an application program in a mobile terminal according to an embodiment of the present invention, and taking six types of analyses, including cpu, sensor, wakelock, gps, wisiscan, and mediascan, as examples, to calculate a running time (english name: tactame) and a total number of running times (english name: tactual) of each of software and hardware, respectively, and further, to further open the sensor type in fig. 5-a, as shown in fig. 5-b, and fig. 5-b is a schematic diagram of another analysis result of power consumption analysis performed on an application program in a mobile terminal according to an embodiment of the present invention, which details running times and total number of running times of a plurality of sensors. After analyzing the monitoring result, a corresponding analysis result can be obtained, as shown in fig. 5-c, where fig. 5-c is another analysis result diagram for performing power consumption analysis on the application program in the mobile terminal provided by the embodiment of the present invention, and a function with an abnormal condition is located.
And 14, optimizing the program.
And 15, repeating the process.
The embodiment of the invention can be realized by a monitoring module which is convenient for a developer to locate problems, so that the oriented object is biased to a software developer or a tester. The monitoring module is used for finding problems and positioning problems, and the problems are conveniently solved. On the mobile device based on the linux system, because the running unit of the program running on the linux is a "process", the code of the monitoring module can be logically injected into the maps table of the target process in a ptrace manner, so that the code of the monitoring module is executed in the target process, which is equivalent to hook operation. By using the hook, the function states to be monitored, including the CPU, the sensor, the wakelock and the like, are counted (including the running time, the running times and the function call stack), and when the user needs to view the data, the data are sent to the application program to be viewed and displayed for the user. Therefore, the problem positioning difficulty of developers can be greatly reduced, the problem positioning time can be shortened, the problems can be exposed in time, and the problems can be displayed from a code level. The performance of the application program is not greatly influenced because the file is not stored when the application program runs and works on the virtual machine layer.
The method provided by the embodiment of the invention can monitor the target process, and alarm if illegal function call is found, so as to achieve the purpose of preventing malicious damage. For example, when a user debugs an application program, some programs do not know what reason the operation is wrong, and the condition and the calling flow of the function when the application program is wrong are determined according to the method and the device, so that the reason of the problem can be analyzed. The working logic of an application without source code may also be analyzed.
It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the invention. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required by the invention.
To facilitate a better implementation of the above-described aspects of embodiments of the present invention, the following also provides relevant means for implementing the above-described aspects.
Referring to fig. 6-a, an apparatus 600 for analyzing an application according to an embodiment of the present invention may include: a program determining module 601, a configuration obtaining module 602, a function monitoring module 603, an analyzing module 604, wherein,
a program determining module 601, configured to determine an application program that a user needs to monitor from a mobile terminal;
a configuration obtaining module 602, configured to obtain configuration information of software and hardware that is called when the application runs in the mobile terminal;
a function monitoring module 603, configured to monitor, when the application program is started in the mobile terminal, a calling condition that the function configured in the application program calls the software and the hardware and an operating condition that the software and the hardware operate according to the function according to configuration information of the software and the hardware;
the analysis module 604 is configured to analyze the application program according to a call condition of the function to the software and the hardware, and an operation condition of the software and the hardware according to operation of the function.
In some embodiments of the present invention, referring to fig. 6-b, the function monitor module 603 includes:
a function determining submodule 6031, configured to determine a function to be executed, configured in the application program;
a pointer modification submodule 6032, configured to modify a call pointer of the function to be executed in a manner of reconfiguring a virtual machine in which the application runs;
and a monitoring execution sub-module 6033, configured to start monitoring on the function before the function starts executing according to the modified call pointer, and monitor a call condition of the function to the software and the hardware in the whole execution process from the start of executing until the end of executing, and an operation condition of the software and the hardware operating according to the function.
In some embodiments of the present invention, the function monitoring module 603 is specifically configured to record, when the function executes, the type of the software and the hardware called by the function, the stack on which the function runs, the time when the function starts to execute, and the time when the function ends to execute, and calculate the running time of the software and the hardware running according to the function and the total running times of the function.
In some embodiments of the present invention, the analysis module 604 is specifically configured to analyze a function with an abnormal condition in the application program according to the running time of the function and the total number of times of running of the function, and analyze a stack corresponding to the function with the abnormal condition in the application program.
In some embodiments of the present invention, the analysis module 604 is specifically configured to calculate a program silence period between the application program being switched from a foreground system of the mobile terminal to a background system of the mobile terminal until the application program being switched from the background system back to the foreground system; if the function is executed in the mobile terminal in the program silent period, determining that the function executed in the program silent period in the application program has an abnormal condition, and analyzing a stack corresponding to the function with the abnormal condition.
In some embodiments of the present invention, the configuration information of the software and the hardware includes at least one of the following information: the method comprises the following steps of configuration of a Central Processing Unit (CPU), configuration of a Global Positioning System (GPS), configuration of wireless local area network (WiFi), configuration of a wakelock awakening screen locking program, configuration of a sensor, configuration of a multimedia scanning program and configuration of Bluetooth.
As can be seen from the above description of the embodiments of the present invention, first, an application program that a user needs to monitor is determined from a mobile terminal, then configuration information of software and hardware that the application program calls when running in the mobile terminal is obtained, when the application program is started in the mobile terminal, a call condition of function call software and hardware configured in the application program and an operation condition of the software and hardware operating according to the function are monitored according to the configuration information of the software and hardware, and the application program is analyzed according to the call condition of the function to the software and hardware and the operation condition of the software and hardware operating according to the function. In the embodiment of the invention, the analysis of the application program can be completed through the mobile terminal, and the function configured in the application program can be monitored, so that the monitoring on the function level is realized, and the obtained calling condition and the operation condition are also the functions configured aiming at the bottom layer in the application program, therefore, the application program can be analyzed more finely, the analysis time of the application program is shortened, and the analysis efficiency of the application program is improved.
As shown in fig. 7, for convenience of description, only the parts related to the embodiment of the present invention are shown, and details of the specific technology are not disclosed, please refer to the method part of the embodiment of the present invention. The terminal may be any terminal device including a mobile phone, a tablet computer, a PDA (Personal Digital Assistant), a POS (Point of Sales), a vehicle-mounted computer, etc., taking the terminal as the mobile phone as an example:
fig. 7 is a block diagram illustrating a partial structure of a mobile phone related to a terminal provided in an embodiment of the present invention. Referring to fig. 7, the handset includes: radio Frequency (RF) circuit 77, memory 720, input unit 730, display unit 740, sensor 750, audio circuit 760, wireless fidelity (WiFi) module 770, processor 780, and power supply 790. Those skilled in the art will appreciate that the handset configuration shown in fig. 7 is not intended to be limiting and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components.
The following describes each component of the mobile phone in detail with reference to fig. 7:
the RF circuit 77 may be used for receiving and transmitting signals during information transmission and reception or during a call, and in particular, receives downlink information of a base station and then processes the received downlink information to the processor 780; in addition, the data for designing uplink is transmitted to the base station. In general, the RF circuit 77 includes, but is not limited to, an antenna, at least one Amplifier, a transceiver, a coupler, a Low Noise Amplifier (LNA), a duplexer, and the like. In addition, the RF circuit 77 may also communicate with networks and other devices via wireless communication. The wireless communication may use any communication standard or protocol, including but not limited to Global System for Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), and the like.
The memory 720 may be used to store software programs and modules, and the processor 780 may execute various functional applications and data processing of the cellular phone by operating the software programs and modules stored in the memory 720. The memory 720 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. Further, the memory 720 may include high speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device.
The input unit 730 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the cellular phone. Specifically, the input unit 730 may include a touch panel 731 and other input devices 732. The touch panel 731, also referred to as a touch screen, can collect touch operations of a user (e.g. operations of the user on or near the touch panel 731 by using any suitable object or accessory such as a finger, a stylus, etc.) and drive the corresponding connection device according to a preset program. Alternatively, the touch panel 731 may include two portions of a touch detection device and a touch controller. The touch detection device detects the touch direction of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts it to touch point coordinates, and sends the touch point coordinates to the processor 780, and can receive and execute commands from the processor 780. In addition, the touch panel 731 may be implemented by various types, such as a resistive type, a capacitive type, an infrared ray, and a surface acoustic wave. The input unit 730 may include other input devices 732 in addition to the touch panel 731. In particular, other input devices 732 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.
The display unit 740 may be used to display information input by the user or information provided to the user and various menus of the mobile phone. The Display unit 740 may include a Display panel 741, and optionally, the Display panel 741 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like. Further, the touch panel 731 can cover the display panel 741, and when the touch panel 731 detects a touch operation on or near the touch panel 731, the touch operation is transmitted to the processor 780 to determine the type of the touch event, and then the processor 780 provides a corresponding visual output on the display panel 741 according to the type of the touch event. Although the touch panel 731 and the display panel 741 are two independent components in fig. 7 to implement the input and output functions of the mobile phone, in some embodiments, the touch panel 731 and the display panel 741 may be integrated to implement the input and output functions of the mobile phone.
The handset may also include at least one sensor 750, such as a light sensor, motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor that adjusts the brightness of the display panel 741 according to the brightness of ambient light, and a proximity sensor that turns off the display panel 741 and/or a backlight when the mobile phone is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally, three axes), can detect the magnitude and direction of gravity when stationary, and can be used for applications of recognizing the posture of a mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer and tapping), and the like; as for other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, and an infrared sensor, which can be configured on the mobile phone, further description is omitted here.
WiFi belongs to short-distance wireless transmission technology, and the mobile phone can help a user to receive and send e-mails, browse webpages, access streaming media and the like through the WiFi module 770, and provides wireless broadband Internet access for the user. Although fig. 7 shows the WiFi module 770, it is understood that it does not belong to the essential constitution of the handset, and can be omitted entirely as needed within the scope not changing the essence of the invention.
The processor 780 is a control center of the mobile phone, connects various parts of the entire mobile phone by using various interfaces and lines, and performs various functions of the mobile phone and processes data by operating or executing software programs and/or modules stored in the memory 720 and calling data stored in the memory 720, thereby integrally monitoring the mobile phone. Optionally, processor 780 may include one or more processing units; preferably, the processor 780 may integrate an application processor, which primarily handles operating systems, user interfaces, applications, etc., and a modem processor, which primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into processor 780.
The handset also includes a power supply 790 (e.g., a battery) for powering the various components, which may preferably be logically coupled to the processor 780 via a power management system, so that the power management system may be used to manage charging, discharging, and power consumption.
Although not shown, the mobile phone may further include a camera, a bluetooth module, etc., which are not described herein.
In the embodiment of the present invention, the processor 780 included in the terminal further has a flow of an analysis method for controlling the execution of the above application program executed by the terminal.
It should be noted that the above-described embodiments of the apparatus are merely schematic, where the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. In addition, in the drawings of the embodiment of the apparatus provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, and may be specifically implemented as one or more communication buses or signal lines. One of ordinary skill in the art can understand and implement it without inventive effort.
Through the above description of the embodiments, those skilled in the art will clearly understand that the present invention may be implemented by software plus necessary general hardware, and may also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components and the like. Generally, functions performed by computer programs can be easily implemented by corresponding hardware, and specific hardware structures for implementing the same functions may be various, such as analog circuits, digital circuits, or dedicated circuits. However, the implementation of a software program is a more preferable embodiment for the present invention. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, where the computer software product is stored in a readable storage medium, such as a floppy disk, a usb disk, a removable hard disk, a Read-Only Memory (ROM), a Random-Access Memory (RAM), a magnetic disk or an optical disk of a computer, and includes instructions for enabling a computer device (which may be a personal computer, a server, or a network device) to execute the method according to the embodiments of the present invention.
In summary, the above embodiments are only used for illustrating the technical solutions of the present invention, and not for limiting the same; although the present invention has been described in detail with reference to the above embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the above embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (12)
1. An application program analysis method, applied to a mobile terminal, includes:
determining an application program which needs to be monitored by a user from a mobile terminal;
acquiring configuration information of software and hardware called when the application program runs in the mobile terminal;
when the application program is started in the mobile terminal, monitoring functions in the application program according to the configuration information of the software and the hardware, and monitoring the calling condition of the software and the hardware called by the functions configured in the application program and the running condition of the software and the hardware running according to the functions;
judging whether the calling condition of the function to the software and the hardware, the running time of the function running in the running condition of the function running and the total running times of the function exceed a preset comparison standard or not, determining the function exceeding the comparison standard as a function with an abnormal condition in an application program, analyzing a stack corresponding to the function with the abnormal condition in the application program, and positioning a code line with the abnormal condition by the stack.
2. The method according to claim 1, wherein the monitoring, according to the configuration information of the software and hardware, the calling condition of the function configured in the application program calling the software and hardware and the running condition of the software and hardware running according to the function comprises:
determining a function which is configured in the application program and needs to be executed;
modifying the call pointer of the function to be executed in a mode of reconfiguring the virtual machine operated by the application program;
and starting monitoring the function before the function starts to execute according to the modified call pointer, and monitoring the calling condition of the function to the software and hardware and the running condition of the software and hardware running according to the function in the whole execution process from the start of execution to the end of execution.
3. The method according to claim 1, wherein the monitoring, according to the configuration information of the software and hardware, the calling condition of the function configured in the application program calling the software and hardware and the running condition of the software and hardware running according to the function comprises:
and recording the types of the software and the hardware called by the function, the stack of the function operation, the time of starting the function execution and the time of finishing the function execution, and calculating the operation time of the software and the hardware according to the function operation and the total operation times of the function.
4. The method according to claim 1, wherein the determining whether the calling condition of the function to the software and the hardware, the running time of the function running by the software and the hardware according to the running condition of the function running and the total running times of the function exceed a pre-configured comparison criterion, determining the function exceeding the comparison criterion as a function with an abnormal condition in an application program, and analyzing a stack corresponding to the function with the abnormal condition in the application program comprises:
calculating a program silence period between the application program being switched from a foreground system of the mobile terminal to a background system of the mobile terminal until the application program being switched back from the background system to the foreground system;
if the function is executed in the mobile terminal in the program silent period, determining that the function executed in the program silent period in the application program has an abnormal condition, and analyzing a stack corresponding to the function with the abnormal condition.
5. The method according to any one of claims 1 to 4, wherein the configuration information of the software and the hardware comprises at least one of the following information: the method comprises the following steps of configuration of a Central Processing Unit (CPU), configuration of a Global Positioning System (GPS), configuration of wireless local area network (WiFi), configuration of a wakelock awakening screen locking program, configuration of a sensor, configuration of a multimedia scanning program and configuration of Bluetooth.
6. An apparatus for analyzing an application program, the apparatus being applied to a mobile terminal, comprising:
the program determining module is used for determining an application program which needs to be monitored by a user from the mobile terminal;
the configuration acquisition module is used for acquiring configuration information of software and hardware called when the application program runs in the mobile terminal;
the function monitoring module is used for monitoring functions in the application program according to the configuration information of the software and the hardware when the application program is started in the mobile terminal, and monitoring the calling condition of the software and the hardware called by the functions configured in the application program and the running condition of the software and the hardware running according to the functions;
and the analysis module is used for judging whether the calling condition of the function to the software and the hardware, the running time of the function running in the running condition of the function running and the total running times of the function exceed a preset comparison standard or not, determining the function exceeding the comparison standard as a function with an abnormal condition in the application program, analyzing a stack corresponding to the function with the abnormal condition in the application program, and positioning a code line with the abnormal condition by the stack.
7. The apparatus of claim 6, wherein the function monitoring module comprises:
the function determining submodule is used for determining a function which is configured in the application program and needs to be executed;
the pointer modification submodule is used for modifying the call pointer of the function to be executed in a mode of reconfiguring the virtual machine operated by the application program;
and the monitoring execution submodule is used for starting monitoring the function before the function starts to execute according to the modified call pointer, and monitoring the calling condition of the function to the software and the hardware in the whole execution process from the start of execution to the end of execution and the running condition of the software and the hardware running according to the function.
8. The apparatus according to claim 6, wherein the function monitoring module is specifically configured to record, during the execution of the function, a type of the software and the hardware of the function call, a stack of the function execution, a time when the function starts to execute, and a time when the execution ends, and calculate a running time of the software and the hardware according to the function execution and a total number of times of the function execution.
9. The apparatus according to claim 6, wherein the analysis module is specifically configured to calculate a program silence period between the application switching from a foreground system of the mobile terminal to a background system of the mobile terminal until the application switching from the background system back to the foreground system; if the function is executed in the mobile terminal in the program silent period, determining that the function executed in the program silent period in the application program has an abnormal condition, and analyzing a stack corresponding to the function with the abnormal condition.
10. The apparatus according to any one of claims 6 to 9, wherein the configuration information of the software and hardware comprises at least one of the following information: the method comprises the following steps of configuration of a Central Processing Unit (CPU), configuration of a Global Positioning System (GPS), configuration of wireless local area network (WiFi), configuration of a wakelock awakening screen locking program, configuration of a sensor, configuration of a multimedia scanning program and configuration of Bluetooth.
11. A mobile terminal, comprising: a memory and a processor;
the memory is used for storing a computer program;
the processor is configured to execute a computer program stored in the memory;
the computer program is for performing the method of analysis of an application program according to any one of claims 1 to 5.
12. A computer-readable storage medium, characterized in that a computer program is stored in the storage medium for executing the analysis method of the application program according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610203095.6A CN107291586B (en) | 2016-04-01 | 2016-04-01 | Application program analysis method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610203095.6A CN107291586B (en) | 2016-04-01 | 2016-04-01 | Application program analysis method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107291586A CN107291586A (en) | 2017-10-24 |
| CN107291586B true CN107291586B (en) | 2021-04-27 |
Family
ID=60087518
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610203095.6A Active CN107291586B (en) | 2016-04-01 | 2016-04-01 | Application program analysis method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107291586B (en) |
Families Citing this family (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107832190B (en) * | 2017-10-31 | 2020-09-22 | 维沃移动通信有限公司 | Diagnosis method for power consumption abnormity, mobile terminal and storage medium |
| CN110297744A (en) * | 2018-03-23 | 2019-10-01 | 优信拍（北京）信息科技有限公司 | A kind of APP applied statistics time setting method and statistical method |
| CN108595309A (en) * | 2018-05-16 | 2018-09-28 | 云南大学 | High energy consumption software evaluation method based on wakelock |
| CN109189478B (en) * | 2018-08-27 | 2020-12-29 | 中国科学院计算技术研究所 | Feedback optimization method for application program |
| JP6724960B2 (en) * | 2018-09-14 | 2020-07-15 | 株式会社安川電機 | Resource monitoring system, resource monitoring method, and program |
| CN109284217B (en) * | 2018-09-28 | 2023-01-10 | 平安科技（深圳）有限公司 | Application program exception handling method and device, electronic equipment and storage medium |
| CN109922141A (en) * | 2019-02-21 | 2019-06-21 | 北京宝兰德软件股份有限公司 | The real time acquiring method and device of activity request list in Java application server |
| CN113110965A (en) * | 2021-03-12 | 2021-07-13 | 北京健康之家科技有限公司 | Abnormal information monitoring method and device, computer storage medium and terminal |
| CN113094228A (en) * | 2021-03-19 | 2021-07-09 | 联想(北京)有限公司 | Task monitoring method and device, equipment and storage medium |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103309790A (en) * | 2013-07-04 | 2013-09-18 | 福建伊时代信息科技股份有限公司 | Method and device for monitoring mobile terminal |
| CN103902890A (en) * | 2012-12-24 | 2014-07-02 | 珠海市君天电子科技有限公司 | Monitoring method and monitoring system for Android program behaviors |
| CN104268055A (en) * | 2014-09-01 | 2015-01-07 | 腾讯科技（深圳）有限公司 | Program exception monitoring method and device |
| CN104794059A (en) * | 2015-05-08 | 2015-07-22 | 北京理工大学 | Defect positioning method and device based on function calling records |
| CN104809397A (en) * | 2015-05-12 | 2015-07-29 | 上海斐讯数据通信技术有限公司 | Android malicious software detection method and system based on dynamic monitoring |
| CN105095741A (en) * | 2014-05-13 | 2015-11-25 | 北京奇虎测腾科技有限公司 | Behavior monitoring method and behavior monitoring system of application program |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2015191394A1 (en) * | 2014-06-09 | 2015-12-17 | Northrop Grumman Systems Corporation | System and method for real-time detection of anomalies in database usage |
-
2016
- 2016-04-01 CN CN201610203095.6A patent/CN107291586B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103902890A (en) * | 2012-12-24 | 2014-07-02 | 珠海市君天电子科技有限公司 | Monitoring method and monitoring system for Android program behaviors |
| CN103309790A (en) * | 2013-07-04 | 2013-09-18 | 福建伊时代信息科技股份有限公司 | Method and device for monitoring mobile terminal |
| CN105095741A (en) * | 2014-05-13 | 2015-11-25 | 北京奇虎测腾科技有限公司 | Behavior monitoring method and behavior monitoring system of application program |
| CN104268055A (en) * | 2014-09-01 | 2015-01-07 | 腾讯科技（深圳）有限公司 | Program exception monitoring method and device |
| CN104794059A (en) * | 2015-05-08 | 2015-07-22 | 北京理工大学 | Defect positioning method and device based on function calling records |
| CN104809397A (en) * | 2015-05-12 | 2015-07-29 | 上海斐讯数据通信技术有限公司 | Android malicious software detection method and system based on dynamic monitoring |
Non-Patent Citations (1)
| Title |
|---|
| 动态注入技术;hncscwc;《https://my.oschina.net/hncscwc/blog/638648》;20160316;第1-2页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107291586A (en) | 2017-10-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107291586B (en) | Application program analysis method and device | |
| CN108415739B (en) | Hook method and device for dynamic link library function and storage medium | |
| CN106850978B (en) | Application program control method and related equipment | |
| CN107608861B (en) | Cooling control method and device | |
| CN107329901B (en) | Data packet capturing method, terminal, server and storage medium | |
| US10657347B2 (en) | Method for capturing fingerprint and associated products | |
| CN112148579B (en) | User interface testing method and device | |
| WO2015078342A1 (en) | Method for acquiring memory information, and terminal | |
| CN108073495B (en) | Method and device for positioning crash reason of application program | |
| CN106294108B (en) | Application program testing method and device | |
| CN110968508B (en) | Method, device, terminal and storage medium for determining loading time of applet | |
| CN109714476B (en) | Data processing method and device, mobile terminal and storage medium | |
| CN110046497B (en) | Function hook realization method, device and storage medium | |
| CN107734618B (en) | Application program closing method and device, storage medium and electronic equipment | |
| CN110413497B (en) | Abnormality monitoring method, abnormality monitoring device, terminal device and computer-readable storage medium | |
| CN112415367A (en) | Drive chip abnormality detection method and device, electronic equipment and readable storage medium | |
| CN112749074A (en) | Test case recommendation method and device | |
| CN107872367B (en) | Black screen detection method, mobile terminal and computer readable storage medium | |
| CN107832191B (en) | Black screen detection method, mobile terminal and computer readable storage medium | |
| CN107832131B (en) | Application program closing method and device, storage medium and electronic equipment | |
| CN106709330B (en) | Method and device for recording file execution behaviors | |
| US11150913B2 (en) | Method, device, and terminal for accelerating startup of application | |
| CN108076200B (en) | Mobile terminal restart positioning method, mobile terminal and computer readable storage medium | |
| CN107122204B (en) | Application unloading state detection method and device | |
| CN109286571A (en) | The method, apparatus and storage device of mobile terminal and application program limit core and limit net |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |